Harden compiler boundaries and D-004 protocol

[chasebryan]

Summary

• harden diagnostic, source, and argument escaping while preserving exact caret widths
• bound hostile CLI replay, stream evaluation output, share module identity, and make output failures fail closed without retrying buffered bytes
• revise D-004 into an explicit pre-freeze v0.2 protocol with neutral candidate mapping, 31 case variants, resource accounting, and nine freeze-readiness items

Why

The accepted S3a implementation had terminal-display ambiguity, avoidable evaluation memory amplification, and output-failure paths that could report or retry writes inconsistently. The D-004 draft also described a symmetric executable packet before its fixtures, schema, runner, and authority were frozen.

Impact

Healthy S3a source, status, and evaluation bytes remain unchanged. Diagnostics now escape unsafe or ambiguous source text, output I/O failures return status 1, and evaluator output is streamed after complete validation. D-004 remains unselected and does not authorize S3b.

Validation

• make check (format, Clippy, rustdoc, 104 Rust tests including doc tests, 103 Python tests, and policy 0.2.8)
• cargo test --manifest-path compiler/Cargo.toml --workspace --all-targets --release --locked --offline (103 optimized Rust tests)